Privacy Policy

Effective Date: 24 May 2026 · Version: v2.2.0

This policy describes how TalentVibe Inc. ("TalentVibe", "we") handles personal information collected through our pre-launch waitlist at talentvibe.io. We follow the Personal Information Protection and Electronic Documents Act (PIPEDA), Canada's federal private-sector privacy law. The ten sections below map to PIPEDA Principles 3 (consent), 4 (limiting collection), 5 (limiting use/disclosure/retention), 7 (safeguards), 9 (individual access), and 10 (challenging compliance).

1. What we collect

When you submit the waitlist form, we collect:

Everyone: first name, last name, email address, phone number, and city.
Performers: performer category, years of experience, whether you have completed a paid gig in the last 12 months, a demo link or a "demo to be added later" flag, a short bio, and optional venue references.
Clients: client type and an optional website URL.

We do not collect: IP-based tracking data, third-party analytics cookies, or payment data.

We do collect precise location, in our mobile app and in our web app, and only when you ask us to. The waitlist form above collects nothing but the city you type. The apps are different: they read your device's precise location at the moment you tap a control that needs it, such as sorting nearby Talent by distance in the mobile app, or confirming you have arrived at a venue in either app. They never read your location in the background, and never while the app is closed. Section 5.1 below describes the venue check-in in detail. An earlier version of this policy stated that we do not collect precise location. That statement was inaccurate, and this paragraph replaces it.

2. Why we collect it

We collect this information for one purpose only: to notify you when TalentVibe launches in your area and to gauge interest by city and role. We will not contact you for any other reason without your further consent. This is the consent you provide when you check the box on the waitlist form (PIPEDA Principle 3: meaningful consent).

3. How we use it

Send a launch-notification email when bookings go live in your city.
Performers who indicated "demo to be added later" receive a separate follow-up email approximately three days after signup, reminding them to add a demo.
TalentVibe administrators may view rows in our database for moderation and abuse prevention.

Your information is not used for advertising, not sold, and not shared with third parties for their own purposes. We do share data with service providers acting strictly on our behalf. See section 4.1 below (PIPEDA Principle 5: limiting use).

4. Who sees it

Your information is stored in a Supabase Postgres database in Canada (ca-central-1, Toronto). Supabase Inc. is ISO/IEC 27001 certified for information security management and acts as our data processor under a written Data Processing Agreement. The data is accessed only by TalentVibe administrators via row-level-security-restricted queries. We will disclose your information to third parties only if compelled by Canadian court order.

4.1 Service providers we use today (waitlist)

To operate the waitlist, we use the following service providers. Each acts on our behalf under a written Data Processing Agreement and may only use your data to perform the function listed.

Supabase Inc.: database, authentication, and edge functions. Data hosted in Canada (Toronto, ca-central-1).
Resend Inc.: transactional email delivery (waitlist welcome and follow-up emails). Processes your email address and first name only. Resend Inc. is incorporated in the United States.
Vercel Inc.: application hosting and global content delivery network. Vercel processes HTTP requests but does not log personal data on our behalf. Vercel Inc. is incorporated in the United States; CDN edges operate globally.

4.2 Additional processors at marketplace launch

When TalentVibe's booking marketplace goes live (separate from this waitlist), we will additionally use:

Stripe: payment processing for bookings. Receives your payment instrument, transaction amount, and billing email directly via Stripe Elements. We never see or store your card number. Stripe processes Canadian transactions through Stripe Payments Canada Ltd.; fraud-detection signals may be evaluated in the United States. Subject to a written DPA.
Sentry (Functional Software Inc.): anonymized diagnostic error monitoring. Sentry receives only technical error reports with cookies, authentication headers, request bodies, email addresses, and IP addresses stripped at our application layer before transmission. The only identifier sent is a random database UUID linked to your session, never your name or email. Sentry servers are located in the United States; subject to a written DPA. We use Sentry because no Canadian-hosted equivalent currently meets our reliability requirements; the data minimization above is our PIPEDA-aligned mitigation.

This policy will be re-versioned at marketplace launch with effective dates for the additional processors. You will be notified by email and asked to consent to the new version before continuing to use the marketplace.

5. How long we keep it

24 months from your signup date, after which your record is deleted. If TalentVibe launches in your area before 24 months elapse and you create an account, your waitlist record is migrated to your account (with new consent at that time) and the standalone waitlist record is deleted (PIPEDA Principle 5: retention).

5.1 Venue check-in (mobile app and web app)

Why we take the reading. On the day of a Vibe, the Talent performing it can tap Check in in our mobile app, or in our web app in the browser, to confirm they have arrived at the venue. The app takes a single location reading at that moment, and only at that moment. A browser cannot tell us whether a location was simulated, so a check-in taken in the web app is recorded as coming from the browser, and we weigh it accordingly. We do not read your location before the tap, after it, or while the app is in the background. There is no continuous or background location collection anywhere in TalentVibe.

What we keep. From that reading we store how far it was from the venue, whether the result was conclusive, how precise the reading itself was, and the time it was taken. We also store the reading itself, meaning the coordinates, for 90 days. The record exists so that a person reviewing a disputed Vibe can see what happened. It is evidence and not proof: a location reading can be wrong or can be faked, and we never treat one as a decision on its own.

How long we keep it. These are two separate things and we state them separately, because one sentence covering both would be true of neither.

The Talent's own position is removed after 90 days. A scheduled job erases the coordinates from every check-in older than that. The distance, the result, the precision and the time remain, so the record of what happened survives without the position that produced it.
The venue's address and its coordinates are part of the Vibe record and are kept with it while the client has an account. The client supplies the venue address when they arrange the Vibe, and we resolve that address to a point so a check-in has something to measure against. The address and the point stay with the Vibe record. A copy of the point is also written into our tamper-evident change history, which we retain for a minimum of seven years to meet tax and legal obligations. The 90 day removal described above does not reach the change history, and we would rather tell you that than let you assume otherwise. If the client deletes their account, each of their Vibes keeps only the city, the province, the first three characters of the postal code and the event's time zone: the street, the number and the unit are removed, the point is rounded to about a kilometre, and the full address and point are removed from the change history too. While a dispute on that Vibe is open we keep the whole address as evidence, and reduce it in the same way when the dispute closes. A Talent deleting their account does not change the venue.

Who else sees it. The client sees only that a check-in happened and roughly how far from the venue it was. The client never sees the Talent's coordinates. TalentVibe staff can see the whole record and look at it only when reviewing a disputed Vibe. To turn a venue address into a point we send that address to a third-party geocoding provider, acting on our behalf under a written Data Processing Agreement; we send the venue address only, never the Talent's own reading.

6. How to access or delete your data

Email hello@talentvibe.io from the address you signed up with. We will delete your record within 30 days. You can also request a copy of your record (right of access, PIPEDA Principles 9 and 10).

Deleting a TalentVibe account. When you delete your account in the app, we erase your personal details straight away: your name (you appear as "Deleted user" from then on), photo, phone, location, profile text, social links, photos and videos, the notes you wrote on a Vibe, and the text of messages you sent. You can no longer sign in, and you no longer appear in search. If you are a Talent, you are also removed from our site map and from other people's favourites, and your public page stops working. Photos and files that could not be removed straight away are removed by a scheduled job that tries again every hour. Some records are kept, because the other person on a Vibe, our tax filings and any dispute depend on them: every Vibe record and its payments, refunds and dispute statements, the reviews you wrote (shown as written by "Deleted user"), and a Talent's HST number. On the Vibes you arranged, we keep only the venue's city, province, the first three characters of its postal code and the event's time zone. The street, number and unit are removed, and the map point is rounded to about a kilometre. While a dispute on one of those Vibes is open, we keep its whole address as evidence and reduce it in the same way when the dispute closes. Our change history keeps a record that each change happened, with your name and contact details removed. You can use the same email address again to create a new, separate account.

When our staff remove an account. If a TalentVibe administrator removes an account, for example after a safety report, the account is banned straight away. Its personal details are erased in the same way as above once it has no open Vibes. Until then the person cannot sign in and cannot be found, and our staff finish the erasure once those Vibes are over; a daily check keeps it on their list until it is done.

7. Security

We use TLS in transit and row-level security at rest. Our anonymous public key has no SELECT permission on the waitlist table, only INSERT (a soft-launch deviation; v2.1.1 adds an edge function with rate-limiting and bot mitigation). This addresses PIPEDA Principle 7: safeguards.

In the event of a privacy breach, we follow PIPEDA's Breach of Security Safeguards Regulations: any breach posing a real risk of significant harm is reported to the Office of the Privacy Commissioner of Canada and to affected individuals as soon as feasible. Our breach-response runbook and 24-month breach log are maintained internally; contact hello@talentvibe.io to reach the Privacy Officer (Alex Kopacz).

8. Changes to this policy

We will not retroactively change the use of data already collected. New versions of this policy apply only to signups received after the new effective date. The version of the policy you consented to is recorded against your waitlist record at signup time.

9. Contact

TalentVibe Inc. · London, Ontario · hello@talentvibe.io

Privacy Officer: Alex Kopacz, Founder · hello@talentvibe.io (PIPEDA Principle 1: Accountability; Quebec Law 25 § 3.1)

10. About this version

This is privacy policy version v2.2.0, effective 24 May 2026. Stored as policy_version='v2.2.0' against your waitlist record so you and we can both prove which policy text your consent applies to.

Changes from v2.1.0:

Updated Supabase hosting region from US East 2 (Ohio) to Canada Central (Toronto, ca-central-1), reflecting our database migration completed in May 2026.
Added section 4.1 disclosing all service providers currently used for the waitlist (Supabase, Resend, Vercel) with their roles, locations, and DPA status.
Added section 4.2 disclosing additional processors (Stripe for payments, Sentry for anonymized diagnostic error monitoring) that will apply when the booking marketplace launches.

Existing waitlist signups consented under v2.1.0 remain governed by v2.1.0 for their original collection purposes. v2.2.0 applies to signups received on or after 24 May 2026 and to any future processing for which we obtain renewed consent at marketplace launch.